more elasticsearch wrangling